[zahin-mohammad]

Description

Follow-up to #10024.

getECDHKeychain returned Promise<any | undefined>, so TypeScript could not require callers to handle the missing-keychain result introduced for passkey-only accounts. This change:

• adds a concrete EcdhKeychain type;
• overloads getECDHKeychain so the default call returns a keychain, while { allowMissing: true } returns EcdhKeychain | undefined;
• makes bulkAcceptShare select the required or optional overload explicitly;
• reports a missing encrypted ECDH private key as a keychain setup error instead of an incorrect password; and
• documents the passkey-only multi-key rotation flow.

Password-verification clarification

This follow-up intentionally does not call verifyPassword when the ECDH keychain is absent. Creating a login password also creates the Elliptic Curve Diffie-Hellman (ECDH) sharing key. The affected WCN-3735 account authenticated with a passkey and had skipped both one-time password setup and ECDH creation, as tracked in CUS-2179. There is therefore no login password to verify in that branch; requiring verification would restore the original failure.

Issue Number

WCN-3735

Type of change

• Bug fix (non-breaking change which fixes an issue)
• This change requires a documentation update

How Has This Been Tested?

Node.js 22.23.3:

• modules/sdk-core/test/unit/bitgo/wallet/walletsEncryptionVersion.ts: 14 passing
• modules/sdk-api/test/unit/bitgoAPI.ts: 77 passing
• ESLint passed for all changed TypeScript files.
• Prettier passed for all changed files.
• Targeted TypeScript checks verified the required and optional overloads and both changed SDK modules.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My commits follow Conventional Commits and include the ticket reference
• I updated the public method and option documentation
• I added tests covering the newly exposed malformed-keychain case
• New and existing focused unit tests pass locally

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[linear-code]

WCN-3735

[zahin-mohammad]

Closing this follow-up because it is not required for the WCN-3735 runtime fix. The merged change already handles passkey accounts without an ECDH keychain; tightening the public TypeScript return type adds source-compatibility risk without being necessary for that behavior.

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run